{"id":"CVE-2026-11814","title":"A command injection vulnerability in the listed NETGEAR models allows a network-adjacent attacker with the ability to intercept and modify local network traffic (attacker-in-the-middle) to compromise the confidentiality and integrity of …","summary":"A command injection vulnerability in the listed NETGEAR models allows a network-adjacent attacker with the ability to intercept and modify local network traffic (attacker-in-the-middle) to compromise the confidentiality and integrity of …","severity":"medium","cvss":6.8,"cvssVector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":["CWE-295","CWE-77"],"vendor":"netgear","product":"be9300_firmware","affected":["be9300_firmware < 1.0.1.84","mr60_firmware < 1.1.8.142","ms60_firmware < 1.1.8.142","r6700ax_firmware < 1.0.18.164","rax10_firmware < 1.0.5.50","rax120_firmware < 1.2.10.56","rax120v2_firmware < 1.2.10.56","rax20_firmware < 1.0.17.142","rax28_firmware < 1.0.14.108","rax29_firmware < 1.0.14.108","rax30_firmware < 1.0.14.108","rax36s_firmware < 1.0.5.50","rax43_firmware < 1.0.17.142","rax45_firmware < 1.0.17.142","rax50_firmware < 1.0.17.142","rax70_firmware < 1.0.19.172","rbr760_firmware < 6.3.8.11","rbs760_firmware < 6.3.8.11","rs100_firmware < 1.0.1.80","rs200_firmware < 1.0.1.90","rs280_firmware < 1.0.1.90","rs300_firmware < 1.0.1.90","rs500_firmware < 1.0.1.90","rs600_firmware < 1.0.1.90","rs70_firmware < 1.0.1.80","rs90_firmware < 1.0.1.80"],"patched":["be9300_firmware 1.0.1.84","mr60_firmware 1.1.8.142","ms60_firmware 1.1.8.142","r6700ax_firmware 1.0.18.164","rax10_firmware 1.0.5.50","rax120_firmware 1.2.10.56","rax120v2_firmware 1.2.10.56","rax20_firmware 1.0.17.142","rax28_firmware 1.0.14.108","rax29_firmware 1.0.14.108","rax30_firmware 1.0.14.108","rax36s_firmware 1.0.5.50","rax43_firmware 1.0.17.142","rax45_firmware 1.0.17.142","rax50_firmware 1.0.17.142","rax70_firmware 1.0.19.172","rbr760_firmware 6.3.8.11","rbs760_firmware 6.3.8.11","rs100_firmware 1.0.1.80","rs200_firmware 1.0.1.90","rs280_firmware 1.0.1.90","rs300_firmware 1.0.1.90","rs500_firmware 1.0.1.90","rs600_firmware 1.0.1.90","rs70_firmware 1.0.1.80","rs90_firmware 1.0.1.80"],"published":"2026-08-11","updated":"2026-09-09","sourceUpdated":"2026-09-09T03:00:03.993","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-11814","references":[{"url":"https://kb.netgear.com/000070887/August-2026-NETGEAR-Security-Advisory","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/be9300/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/mr60/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/ms60/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/r6700ax/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax10/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax120/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax120v2/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax20/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax28/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax29/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax30/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax36s/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax43/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax45/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax50/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rax70/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rbr760/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rbs760/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rs100/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rs200/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rs280/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rs300/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rs500/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rs600/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rs70/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"},{"url":"https://www.netgear.com/support/product/rs90/","label":"a2826606-91e7-4eb6-899e-8484bd4575d5"}],"tags":["nvd"],"epss":0.00914,"epssPercentile":0.58371,"ingestedAt":"2026-08-29T19:41:14.560Z","slug":"CVE-2026-11814","body":"## Overview\n\nA command injection vulnerability in the listed NETGEAR models allows a network-adjacent attacker with the ability to intercept and modify local network traffic (attacker-in-the-middle) to compromise the confidentiality and integrity of the affected device. This issue is limited to certain region-specific SKUs.\n\n## Affected\n\n- `be9300_firmware < 1.0.1.84`\n- `mr60_firmware < 1.1.8.142`\n- `ms60_firmware < 1.1.8.142`\n- `r6700ax_firmware < 1.0.18.164`\n- `rax10_firmware < 1.0.5.50`\n- `rax120_firmware < 1.2.10.56`\n- `rax120v2_firmware < 1.2.10.56`\n- `rax20_firmware < 1.0.17.142`\n- `rax28_firmware < 1.0.14.108`\n- `rax29_firmware < 1.0.14.108`\n- `rax30_firmware < 1.0.14.108`\n- `rax36s_firmware < 1.0.5.50`\n- `rax43_firmware < 1.0.17.142`\n- `rax45_firmware < 1.0.17.142`\n- `rax50_firmware < 1.0.17.142`\n- `rax70_firmware < 1.0.19.172`\n- `rbr760_firmware < 6.3.8.11`\n- `rbs760_firmware < 6.3.8.11`\n- `rs100_firmware < 1.0.1.80`\n- `rs200_firmware < 1.0.1.90`\n- `rs280_firmware < 1.0.1.90`\n- `rs300_firmware < 1.0.1.90`\n- `rs500_firmware < 1.0.1.90`\n- `rs600_firmware < 1.0.1.90`\n- `rs70_firmware < 1.0.1.80`\n- `rs90_firmware < 1.0.1.80`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `be9300_firmware 1.0.1.84`\n- `mr60_firmware 1.1.8.142`\n- `ms60_firmware 1.1.8.142`\n- `r6700ax_firmware 1.0.18.164`\n- `rax10_firmware 1.0.5.50`\n- `rax120_firmware 1.2.10.56`\n- `rax120v2_firmware 1.2.10.56`\n- `rax20_firmware 1.0.17.142`\n- `rax28_firmware 1.0.14.108`\n- `rax29_firmware 1.0.14.108`\n- `rax30_firmware 1.0.14.108`\n- `rax36s_firmware 1.0.5.50`\n- `rax43_firmware 1.0.17.142`\n- `rax45_firmware 1.0.17.142`\n- `rax50_firmware 1.0.17.142`\n- `rax70_firmware 1.0.19.172`\n- `rbr760_firmware 6.3.8.11`\n- `rbs760_firmware 6.3.8.11`\n- `rs100_firmware 1.0.1.80`\n- `rs200_firmware 1.0.1.90`\n- `rs280_firmware 1.0.1.90`\n- `rs300_firmware 1.0.1.90`\n- `rs500_firmware 1.0.1.90`\n- `rs600_firmware 1.0.1.90`\n- `rs70_firmware 1.0.1.80`\n- `rs90_firmware 1.0.1.80`","depth":"sunlit","depthScore":38,"depthScoreParts":{"impact":37.4,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[{"seq":201455,"id":"CVE-2026-11814","ts":1789399466973,"field":"cvss","old":null,"new":"6.8"},{"seq":201454,"id":"CVE-2026-11814","ts":1789399466973,"field":"severity","old":"none","new":"medium"},{"seq":200189,"id":"CVE-2026-11814","ts":1789396927831,"field":"cvss","old":"6.8","new":null},{"seq":200188,"id":"CVE-2026-11814","ts":1789396927831,"field":"severity","old":"medium","new":"none"},{"seq":198110,"id":"CVE-2026-11814","ts":1789387967752,"field":"cvss","old":null,"new":"6.8"},{"seq":198109,"id":"CVE-2026-11814","ts":1789387967752,"field":"severity","old":"none","new":"medium"},{"seq":195906,"id":"CVE-2026-11814","ts":1789383305823,"field":"cvss","old":"6.8","new":null},{"seq":195905,"id":"CVE-2026-11814","ts":1789383305823,"field":"severity","old":"medium","new":"none"},{"seq":194835,"id":"CVE-2026-11814","ts":1789380273252,"field":"cvss","old":null,"new":"6.8"},{"seq":194834,"id":"CVE-2026-11814","ts":1789380273252,"field":"severity","old":"none","new":"medium"},{"seq":193622,"id":"CVE-2026-11814","ts":1789378167867,"field":"cvss","old":"6.8","new":null},{"seq":193621,"id":"CVE-2026-11814","ts":1789378167867,"field":"severity","old":"medium","new":"none"},{"seq":192409,"id":"CVE-2026-11814","ts":1789376191941,"field":"cvss","old":null,"new":"6.8"},{"seq":192408,"id":"CVE-2026-11814","ts":1789376191941,"field":"severity","old":"none","new":"medium"},{"seq":191196,"id":"CVE-2026-11814","ts":1789373039641,"field":"cvss","old":"6.8","new":null},{"seq":191195,"id":"CVE-2026-11814","ts":1789373039641,"field":"severity","old":"medium","new":"none"},{"seq":189981,"id":"CVE-2026-11814","ts":1789369094696,"field":"cvss","old":null,"new":"6.8"},{"seq":189980,"id":"CVE-2026-11814","ts":1789369094696,"field":"severity","old":"none","new":"medium"},{"seq":188768,"id":"CVE-2026-11814","ts":1789367990300,"field":"cvss","old":"6.8","new":null},{"seq":188767,"id":"CVE-2026-11814","ts":1789367990300,"field":"severity","old":"medium","new":"none"},{"seq":187551,"id":"CVE-2026-11814","ts":1789364946272,"field":"cvss","old":null,"new":"6.8"},{"seq":187550,"id":"CVE-2026-11814","ts":1789364946272,"field":"severity","old":"none","new":"medium"},{"seq":186338,"id":"CVE-2026-11814","ts":1789362907494,"field":"cvss","old":"6.8","new":null},{"seq":186337,"id":"CVE-2026-11814","ts":1789362907494,"field":"severity","old":"medium","new":"none"},{"seq":185124,"id":"CVE-2026-11814","ts":1789360931612,"field":"cvss","old":null,"new":"6.8"},{"seq":185123,"id":"CVE-2026-11814","ts":1789360931612,"field":"severity","old":"none","new":"medium"},{"seq":183911,"id":"CVE-2026-11814","ts":1789357851891,"field":"cvss","old":"6.8","new":null},{"seq":183910,"id":"CVE-2026-11814","ts":1789357851891,"field":"severity","old":"medium","new":"none"},{"seq":182163,"id":"CVE-2026-11814","ts":1789354056814,"field":"cvss","old":null,"new":"6.8"},{"seq":182162,"id":"CVE-2026-11814","ts":1789354056814,"field":"severity","old":"none","new":"medium"},{"seq":180956,"id":"CVE-2026-11814","ts":1789352879396,"field":"cvss","old":"6.8","new":null},{"seq":180955,"id":"CVE-2026-11814","ts":1789352879396,"field":"severity","old":"medium","new":"none"},{"seq":179749,"id":"CVE-2026-11814","ts":1789349952445,"field":"cvss","old":null,"new":"6.8"},{"seq":179748,"id":"CVE-2026-11814","ts":1789349952445,"field":"severity","old":"none","new":"medium"},{"seq":178542,"id":"CVE-2026-11814","ts":1789347714527,"field":"cvss","old":"6.8","new":null},{"seq":178541,"id":"CVE-2026-11814","ts":1789347714527,"field":"severity","old":"medium","new":"none"},{"seq":177335,"id":"CVE-2026-11814","ts":1789346138183,"field":"cvss","old":null,"new":"6.8"},{"seq":177334,"id":"CVE-2026-11814","ts":1789346138183,"field":"severity","old":"none","new":"medium"},{"seq":176128,"id":"CVE-2026-11814","ts":1789342649240,"field":"cvss","old":"6.8","new":null},{"seq":176127,"id":"CVE-2026-11814","ts":1789342649240,"field":"severity","old":"medium","new":"none"},{"seq":175914,"id":"CVE-2026-11814","ts":1789342262731,"field":"cvss","old":null,"new":"6.8"},{"seq":175913,"id":"CVE-2026-11814","ts":1789342262731,"field":"severity","old":"none","new":"medium"},{"seq":175452,"id":"CVE-2026-11814","ts":1789338287213,"field":"cvss","old":"6.8","new":null},{"seq":175451,"id":"CVE-2026-11814","ts":1789338287213,"field":"severity","old":"medium","new":"none"},{"seq":174247,"id":"CVE-2026-11814","ts":1789334562073,"field":"cvss","old":null,"new":"6.8"},{"seq":174246,"id":"CVE-2026-11814","ts":1789334562073,"field":"severity","old":"none","new":"medium"},{"seq":173042,"id":"CVE-2026-11814","ts":1789333137209,"field":"cvss","old":"6.8","new":null},{"seq":173041,"id":"CVE-2026-11814","ts":1789333137209,"field":"severity","old":"medium","new":"none"},{"seq":171856,"id":"CVE-2026-11814","ts":1789330838533,"field":"cvss","old":null,"new":"6.8"},{"seq":171855,"id":"CVE-2026-11814","ts":1789330838533,"field":"severity","old":"none","new":"medium"}]}